After following this guide you will able to easily and seamlessly switch between multiple AWS accounts and roles (with or without Okta) using the CLI.
Prerequisites:
Check out the first article in the series for requirements and initial configuration.
How To:
The following instructions are meant to be used in Linux or WSL, tested with Ubuntu.
Configure non Okta accounts
aws configure --profile profile
aws configure --profile multi-role-profile
Configure Okta accounts
Create a file ~/.okta-aws
with the following contents:
[okta-profile]
username = <username>
factor = OKTA
app-link = https://<your-company>.okta.com/<app-link>
base-url = <your-company>.okta.com
duration = 3600
[okta-multi-role-profile]
username = <username>
factor = OKTA
app-link = https://<your-company>.okta.com/<app-link>
base-url = <your-company>.okta.com
duration = 3600
Initialize the profiles:
okta-awscli --okta-profile okta-profile --profile okta-profile
okta-awscli --okta-profile okta-multi-role-profile --profile okta-multi-role-profile
Configure accounts with multiple roles
Some accounts might use role switching, add similar sections to ~/.aws/credentials
per role (notice that source_profile
points to a previously defined profile):
[multi-role-profile-role1]
role_arn = <role-arn>
source_profile = multi-role-profile
[okta-multi-role-profile-role1]
role_arn = <role-arn>
source_profile = okta-multi-role-profile
Associate EKS clusters with profiles
Run the following per EKS cluster that you want to have kubectl access to, <profile-name>
is a name of the AWS profile defined above that has permissions for this EKS cluster:
aws --profile <profile-name> eks update-kubeconfig --name <eks-cluster-name>
Create scripts for fast account switching
The scripts switch to the relevant AWS account, point kubectl to the relevant cluster, and set a default kubectl namespace.
Create one script file per profile, and place it in your home directory.
File okta-multi-role-profile-role1
:
export AWS_DEFAULT_PROFILE=okta-multi-role-profile-role1
kubectl config use-context <eks-cluster-arn>
kubectl config set-context --current --namespace=<namespace>
aws sts get-caller-identity
if [[ $PS1 != *"AWS_DEFAULT_PROFILE"* ]]; then
PS1=\(\$AWS_DEFAULT_PROFILE\)$PS1
fi
echo "Switched to okta-multi-role-profile-role1"
Switch between accounts
To quickly switch between accounts just do the following:
source <profile-file>
For example:
source okta-multi-role-profile-role1
Top comments (0)